CVE-2014-2815: Microsoft Onenote

High severity, CVSS 8.8. EPSS: 43.8% chance of exploitation in the next 30 days.

Microsoft OneNote 2007 SP3 allows remote attackers to execute arbitrary code via a crafted OneNote file that triggers creation of an executable file in a startup folder, aka "OneNote Remote Code Execution Vulnerability."

Affected products

• Microsoft Onenote: version 2007 only

Published 2014-08-12. Last modified 2026-06-17.